2 ISPs - I want to keep them totally separate - 1 for Guest traffic and 1 for Internal

[Humongous]

FortiGate 200D 5.2.4 Transparent Mode

Setup - Internal

WAN1 - Internal ISP Router - 66.x.x.x

Port 16 - Internal LAN - 172.x.x.x/16

Setup - Guest

WAN2 - Guest ISP Router - 67.x.x.x

Port 1 - Guest LAN - 10.10.0.0/24

How do I set this up and make sure that the guest LAN and internal LAN traffic does not mix?  Is it possible?  I am a newbie w/ Fortigate...  I appreciate your help!

[ede_pfau]

hi,

and welcome to the forums.

Fortigates can be "virtualized", that is, you can create up to 10 virtual firewalls on one hardware. The keyword is "VDOM" if you look up the concept in the FortiOS Handbook (@ docs.fortinet.com). Each VDOM at least needs 2 ports (input and output) but not necessarily physical ones. By default VDOMs are completely separate unless you connect them over ports. 

IMHO this will enable you to build the setup you are planning.

[Humongous]

I will take a look!  Thank you, Ede!

[CyberNorris]

VDOMs would add unnecessary complexity. I have a couple of clients with dual paths for outbound traffic. Corporate traffic (LAN & WLAN) use WAN1 as the primary outbound and WAN2 as the backup outbound while guests (WLAN) use WAN2 as the primary outbound and WAN1 as the backup outbound.

There are two static routes, both with equal distance. Then there are policy routes (one for each LAN or WLAN network) that direct the corp networks to WAN1 and a policy route that directs the guest network to WAN2. Adding a status check (link health monitor - advanced routing feature must be enabled) for each WAN circuit will let the FortiGate learn if a route is down... and if down it will remove that route from the routing table directing traffic normally using the policy route to the other default route.

Best of luck!

[emnoc]

I agreed a vdom concept would be  the ideal setup and vdom-interliks if the 2 needs to talk.

Ken

[Humongous]

Thanks for your responses - I am waiting for a maintenance window to implement the vdom configuration...  I will let you know how it goes.